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Abstract:  This  paper  proposes  a  methodology  to  build  a 
library  for  gate-level  microelectronics  verification  with 
topological  constraints.  Circuits  at  the  second  level  of 
abstraction  are  selected  from  prior  work  on  simulated 
reverse-engineered  hardware.  We  show  that  when  signal 
pairs  are  switched  while  maintaining  circuit  functionality, 
the  topological  genus  varies  according  to  a  frequency 
distribution  that  differs  for  each  circuit. 
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Introduction 

The  problem  of  hardware  that  might  contain  malicious 
circuitry  or  defects  has  gained  significant  attention  within 
the  Department  of  Defense  (DoD)  within  the  past  two  and 
a  half  decades  [1-11].  Hardware  that  may  compromise 
national  security  systems  must  be  detected  and  prevented 
from  entering  DoD  systems.  The  Defense  Advanced 
Research  Project  Agency  (DARPA)  Trusted  Integrated 
Circuits  (TRUST)  [12-14]  program  was  introduced  to 
focus  on  verification  and  detection  of  tampering.  Our 
prior  work  developed  a  technique  to  detect  altered  or 
additional  circuits  that  do  not  affect  logic  [15,16]. 
Standard  cell  recognition  (SCR)  software  demonstrated  a 
90%  success  rate  of  perfectly  performing  SCR  on  circuits 
containing  650  transistors  [17,18]. 

Topological  Constraints  and  Methodology 

A  circuit  at  any  level  of  abstraction  can  be  represented  as 
a  combinatorial  map  [19,  20]  (for  a  review  see  [21]). 
Such  a  representation  is  based  on  a  two-dimensional 
projection  of  the  circuit  onto  a  plane.  While  there  are 
infinite  ways  to  project  the  circuit  onto  a  plane,  the 
connectivity  between  different  circuit  elements  (among 
terminal  vertices,  gate  vertices,  and  net  vertices)  does  not 
vary  under  2D  projections.  The  collection  of  vertices  and 
connections  (edges)  generate  a  graph  naturally.  In 
particular,  a  combinatorial  map  describes  any  circuit 
diagram  that  has  been  projected  onto  a  2D  surface  by 
using  1)  a  list  of  half-edges  D,  2)  a  permutation  involution 
a  on  D  with  no  fixed  points,  and  3)  a  shift-permutation  a 
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on  D.  The  half-edges  can  be  labeled  with  distinct 
consecutive  integers  [l,..,2m\  (where  m  is  the  number  of 
edges).  The  a  permutation  associates  each  half-edge  i  to 
the  corresponding  half-edge  a(i).  Obviously,  it  is  an 
involution,  a(a(i))=i  (meaning  that  if  the  half-edge  i  is 
connected  to  the  half-edge  j=cc(i)  then  the  half-edge  j  is 
connected  to  the  half-edge  /)  ,  and  without  fixed  points, 
a(i)fi  (no  edge  is  made  of  just  a  single  half-edge).  The 
shift  permutation  a  associates  each  half-edge  i  to  the  half¬ 
edge  a(i)  that  is  to  the  right  of  i  when  turning 
counterclockwise  around  the  common  incident  vertex  (for 
netlist  vertices  and  gate  vertices),  or  turning  clockwise 
(for  terminal  vertices  on  the  external  boundary  of  the 
circuit).  Such  a  representation  fully  encodes  the 
connectivity  information  of  the  various  circuit  elements, 
independently  from  the  3D  embedding.  A  famous 
theorem  by  Euler  allows  the  determination  of  the  Euler 
characteristic  of  a  closed  surface  on  which  the  schematics 
can  be  drawn  without  crossing  connections: 

X=c(a)-c(a)+c(o*a)  (1) 

where  c(p)  indicates  the  number  of  cycles  of  the  permutation 
p  (every  permutation  can  be  decomposed  into  a  set  of  cycles; 
a  cycle  being  a  sequence  of  labels  that  are  mapped  into  each 
other  cyclically).  Moreover,  y=2-2g  where  g  is  the 
topological  genus  of  the  circuit  (i.e.  the  number  of  handles). 
The  calculation  of  the  topological  genus  of  a  circuit  can  be 
conveniently  implemented  in  MATLAB  (Mathworks).  We 
wrote  a  program  to  evaluate  formula  (1)  by  computing  the 
number  of  cycles  of  the  permutations  <7,  a ,  and  a* a.  The 
pseudocode  we  implemented  is  (for  details  see  [22]): 

1.  Given  a  permutation  P,  set  C=0 

2.  while  the  largest  element  x  in  P  is  positive: 

3  Increase  C— ►  C=C+ 1 

4.  Move  to  the  next  element  x  — >  P(x) .  Label  x  as 
visited  by  the  cycle  C,  by  setting  P(x)=-C. 

Repeat  step  4  until  the  next  element  P(x)  is 
positive  (if  it  is  negative,  it  means  that  the 
element  has  been  visited  by  the  cycle  C  already). 

5.  end  while  loop 

6.  Output=-P,  gives  the  cycles  decomposition  of  P 

The  genus  is  obtained  from  the  Euler  characteristic  (g=l- 
%/2).  The  number  of  edges  E  is  given  by  c (a).  The  total 
number  of  blocks  B=G+N  is  given  by  c(<r)-l  (where  the  1 
indicates  the  external  boundary,  G  is  the  gate  count  and  N  is 
the  net  count).  The  number  of  faces  (or  loops)  is  F=c(<j*a). 
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Preliminary  Library 

Of  the  five  proposed  circuits  in  Table  1,  (a)-(d)  are 
adapted  from  [18]. 

Table  1.  Schematics  for  a  (a)  2-to-1  MUX;  (b)  XOR  gate;  (c) 


The  circuits  in  Table  1  are  composed  of  basic  CMOS  gates 
that  typically  comprise  books  in  random  logic  and  semi¬ 
custom  design  methodologies  in  high-performance 
microprocessor  design  [24,  25].  Table  1  shows  schematics 
with  no  switched  signals  of  a  (a)  2-to-l  MUX;  (b)  XOR  gate; 
(c)  Master  Slave  Flip  Flop;  (d)  Partial  full  adder  cell;  (e)  1-bit 
full  adder  cell.  Net,  gate,  and  terminal  vertices  are  labeled 
with  blue  circles,  red  squares,  and  digits,  respectively.  Table 
2  shows  corresponding  topological  constraints. 


Table  2.  Topological  constraints  for  the  library  circuits  in  Table  1. 


Circuit.  Note  that 

c  =  1  [26] 

Topological 
Constraints  [27] 
{G,N,T,B,g,Z,F,E} 

Schematic  Braid 

Words  [27] 

2-to-l  MUX 

{4,  2,  4,  6,  0,  2,  6,  11} 

cr±1,05,6cr±1’08,9  ep1,0n,i2  cp1,0m,i5 

XOR  gate 

{4,  3,  3,  7,  0,  2,  6,  12} 

cp1- °4,5  cP1,07,8  eP'Vn  cP'-Vm 

Master  Slave  Flip 
Flop 

{10,  8,4,  18,  2,  -2,  7,  28} 

CP1'0^  CP1-0^,!!  CP1'0^,  16  CP1,018,19 
CP''021i22  CP1,0 24,25  ePI,027,28  CT^Vsi 

Partial  full  adder 
cell 

{10,  9,  6,  19,  1,0,  11,31} 

CP1,07,8  CP1,0lo,llCr±I'0I3il4 

<Ttl’°22,23Cri:I'027^8 

0^:1, 033  34 

1-bit  full  adder  cell 

{16,10,5,26,5,-8,4,  39} 

1  (no  switches) 

Table  3  shows  two  topological  representations  for  a 
partial  full  adder  cell  with  (a)  one  switched  signal  pair 
(g=2),  and  (b)  nine  switched  signal  pairs  (g=4).  Note  that 
7  crosses  above  8  in  Fig.  1(a). 

Table  3.  Partial  full  adder  cell  with  (a)  one  switched  signal  pair  in 
red  (g=2)  compared  with  Table  1(d);  (b)  nine  switched  signal  pairs 
circled  in  red  (g=4)  compared  with  Table  1(d). _ 
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Frequency  Distributions 

Table  4  shows  the  average  genus  and  mode  for  four 
circuits  when  each  signal  pair  is  switched. 


Table  4.  Average  genus,  g,  with  switched  pairs  in  library  circuits. 


(a)  2-to-l  MUX 

(b)  XOR  Gate 

Pair 

Average  g 

Mode 

Pair 

Average  g 

Mode 

[5,61 

1.750 

2 

[4,51 

1.875 

2 

[8,91 

1.750 

2 

[7,81 

1.750 

2 

[11,121 

1.625 

2 

[io,m 

1.750 

2 

[14,151 

1.625 

2 

[13,141 

1.625 

2 

no 

switches 

0 

(Table  la) 

n/a 

no 

switches 

0 

(Table  lb) 

n/a 

(c)  Master  Slave  FF 

(d)  Partial  Full  Adder  Cell 

Pair 

Average  g 

Mode 

Pair 

Average  g 

Mode 

[7,8] 

3.773 

4 

[7,8] 

4.188 

4 

[io,m 

3.594 

4 

[io,m 

4.125 

4 

[15,16] 

3.539 

4 

[13,141 

4.125 

4 

[18,19] 

3.328 

4 

[16,171 

4.063 

4 

[21,221 

3.672 

4 

[19,201 

4.000 

4 

[24,25] 

3.734 

4 

[22,23] 

4.281 

4 

[27,28] 

3.484 

4 

[27,281 

4.156 

4 

[30,31] 

3.484 

4 

[30,31] 

4.156 

4 

n/a 

n/a 

n/a 

[33,34] 

4.031 

4 

no 

switches 

2 

(Table  lc) 

n/a 

no 

switches 

1  (Tables 

Id,  3b) 

n/a 

Table  5(a)-(d)  and  Fig.  1  show  frequency  distributions  for 
the  2-to-l  MUX  (Table  la);  XOR  Gate  (Table  lb); 
Master  Slave  Flip  Flop  (Table  lc);  partial  full  adder  cell 
(Tables  Id,  3b);  1-bit  full  adder  cell  (Fig.  1),  respectively. 

Table  5.  Frequency  distributions  for  the  genus  of  logically 
equivalent  circuit  topologies  for  (a)  2-to-1  MUX  (16);  XOR  gate 
(16);  (c)  Master  Slave  Flip  Flop  (256);  and  (d)  partial  full  adder  cell 
(512). 


Figure  1  shows  that  switching  signal  pairs  produces 
logically-equivalent  topologies  of  the  1-bit  full  adder  cell 
with  three  values  of  the  genus  (g  =  3  [1  case],  4,  5,  6). 


1-Bit  Full  Adder  Cell 


3  4  5  6 

Genus,  g 

Figure  1.  Frequency  distribution  for  logically  equivalent 
circuit  topologies  of  the  1-bit  full  adder  cell  (2048)  in  Table 
1(e)  for  non-overlapping  switches 
[41 ,42];[44,45];[47,48];[67,68];[74,75];[33,34]; 
[34,35];[35,33];[37,38];[38,39];[39,37];[60,61];[61562];[62,60]. 

Discussion 

It  is  important  to  emphasize  that  a  given  circuit  can  be 
drawn  on  a  plane  in  many  ways,  depending  on  how  the 
2D  projection  is  performed.  An  analogy  can  be  made  by 
considering  different  projections  on  a  plane  of  a  three- 
dimensional  knot.  While  different  planar  projections  look 
different,  the  knot  is  still  the  same.  Analogously,  the 
circuit  functionality  is  determined  uniquely  by  the  specific 
connectivity  of  its  elements,  and  the  actual  2D  schematic 
is  only  one  of  many  possible  representations.  The 
topological  genus  g  is  a  quantity  that  is  capable  of 
capturing  the  complexity  of  the  circuit  connectivity, 
which  is  completely  independent  from  the  chosen  planar 
projection  for  the  schematic,  i.e.  any  different  schematics 
of  the  same  circuit  will  give  the  same  topological  genus  g. 
It  is  shown  here  for  the  first  time  that  by  exploring  the 
space  of  different  circuits,  all  having  the  same 
functionality  (iso-functional),  the  genus  fluctuates  in  a 
fashion  that  is  characteristic  of  the  circuit  itself,  and 
therefore  in  a  fashion  that  is  characteristic  of  its 
functionality.  Such  a  concept  has  been  explored 
extensively  in  biology  for  the  study  of  neutral  mutations 
of  DNA  sequences  (also  known  as  silent  mutations).  Such 
mutations  do  not  significantly  alter  the  characteristics  of 
the  organism  (i.e.  its  functionality)  and  therefore  its 
fitness.  We  apply  a  similar  approach  to  the  study  of  a 
circuit  with  a  given  functionality,  and  the  space  of  iso- 
functional  circuits. 

Future  Work 

Future  work  will  add  capabilities  to  switch  additional 
signals  (See,  for  example,  signals  [6,8]  and  [16,18]  in  Fig. 
2)  and  represent  electrical  properties  of  a  physical  design 
layout  [28]. 
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